Onboard a GKE Cluster in a Shared VPC

Set the Host project ID.
gcloud config set project [HOST_PROJECT_ID]
(
optional
) Set compute zone or region for clusters.
If the cluster is zonal, enter the following:
gcloud config set compute/zone [COMPUTE_ZONE]
If the cluster is regional, enter the following:
gcloud config set compute/region [COMPUTE_REGION]
In the Host project, update secondary ranges in the Trust VPC subnet.
gcloud compute networks subnets update [TRUST_SUBNETWORK_NAME]
  --add-secondary-ranges 
  [PODS_IP_RANGE_NAME] = [POD_RANGE_CIDR],
  [SERVICE_IP_RANGE_NAME]=[SERVICE_RANGE_CIDR]
Pods and service IP ranges must be within: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and cannot collide with existing IP ranges in the subnetwork.
In the Service project, create a private cluster in the shared VPC.
Set the Service project ID.

gcloud config set project [SERVicE_PROJECT_ID]

Create a private cluster in the shared VPC.

gcloud container clusters create  [CLUSTER_NAME] 
  --project [SERVICE_PROJECT_ID]
  --zone=[ZONE_NAME]
  --enable-ip-alias
  --enable-private-nodes
  --network projects/[HOST_PROJECT_ID]/global/networks/[NETWORK_NAME]
  --subnetwork projects/[HOST_PROJECT_ID]/regions/[REGION_NAME]
  /subnetworks/[TRUST_SUBNETWORK_NAME] 
  --cluster-secondary-range-name=[PODS_IP_RANGE_NAME] 
  --services-secondary-range-name=[SERVICE_IP_RANGE_NAME] 
  --master-ipv4-cidr=[MASTER_IPV4_CIDR]
  --enable-master-authorized-networks
  --master-authorized-networks=[PANORAMA_MANAGEMENT_IP/32],
  [MY_MANAGEMENT_IP/32]
Check your current cluster context:
kubectl config current-context
Check all cluster contexts.
kubectl config get-context
Change to another cluster.
kubectl config use-context [CONTEXT_NAME]
If you created your cluster in the GCP console, generate a kubeconfig entry:
gcloud container clusters get-credentials [CLUSTER_NAME]
Create a cluster role in a
.yaml
file—for example,
gke_cluster_role.yaml
.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: gke-plugin-role
rules:
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - list
Apply the cluster role.
kubectl apply -f gke_cluster_role.yaml
Create a cluster role binding in a
.yaml
file—for example,
gke_cluster_role_binding.yaml
.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: gke-plugin-role-binding
subjects:
  - kind: ServiceAccount
    name: [SERVICEACCOUNT_NAME]
    namespace: default
roleRef:
  kind: ClusterRole
  name: gke-plugin-role
  apiGroup: rbac.authorization.k8s.io
Apply the cluster role binding.
kubectl apply -f gke_cluster_role_binding.yaml
Create a service account.
kubectl create serviceaccount [SERVICEACCOUNT_NAME]
Export the service account secret token in JSON format.
MY_TOKEN=`kubectl get serviceaccounts [SERVICEACCOUNT_NAME] 
-o jsonpath='{.secrets[0].name}'`

kubectl get secret $MY_TOKEN -o json > [FILE_NAME].json
Get the API server address.
kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "
In the Panorama plugin for GCP, add the service account information.
Select
Panorama
Google Cloud Platform
Setup
.
Name the credential, enter a description, and enter the
API server address
from step 14, and for
GKE Service Account Credential
upload the JSON file from step 13.
After you add a service account credential, you can validate the credential from your Panorama command line (you cannot validate from the web interface):
request plugins gcp validate-service-account gke_service_account <svc-acct-credential-name>
Set up auto scaling on the Panorama plugin for GCP.
In the Panorama context, expand Google Cloud Platform, select AutoScaling, and click
Add
.
Supply the
Firewall Deployment Name
and an optional description for the deployment.
For the
GCP Service Account Credential
, supply the GCP service account name from Step 15.
Chose the Device Group and the Template Stack you created in when you configured the Panorama plugin.
Disable
License Management Only
to ensure traffic is secured.
Enter the exact
GKE Cluster Name
.
(
Optional
) Enter a
Description
of the GKE cluster.
Enter the
Network CIDR
for the GKE cluster.
Select the
GKE Service Account
corresponding to the GKE cluster.
Commit your changes.
(
Optional
) Create and deploy a service template according to Using the Sample GKE Service Templates, or deploy a GKE service in the GCP console. .